Opencms
Vendor:
First CVE: Dec 16, 2005 · Active for 20 years
33
Total CVEs
More Total CVEs than 96% of tracked products
2.5
Avg CVEs / Year
Higher CVE frequency than 75% of tracked products
5.3
Avg CVSS
Higher Avg CVSS than 11% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Opencms over time
Volume of CVEsAvg CVSS Base Score
First CVE
Dec 16, 2005
20 years ago
Most Recent CVE
Feb 19, 2026
155 days ago
CVE Severity & Scoring
Opencms33 CVEs
88%
All CVEs352,231 CVEs
45%
40%
11%
LowMediumHigh
Attack Vector
Local1 (3.0%)
Network17 (51.5%)
Unknown15 (45.5%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low17 (51.5%)
High1 (3.0%)
Unknown15 (45.5%)
User Interaction
None3 (9.1%)
Unknown15 (45.5%)
Required15 (45.5%)
Privileges Required
Low9 (27.3%)
High0 (0.0%)
None9 (27.3%)
Unknown15 (45.5%)
Top CVEs
Signals from CVEs in this product scope (33 CVEs).
33 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2018-8811HIGH Cross-site request forgery (CSRF) vulnerability in system/workplace/admin/accounts/user_role.jsp in OpenCMS 10.5.3 allows remote attackers to hijack the authentication of administr | Mar 20, 2018 | 8.8 | 39 | NO | YES |
CVE-2019-13236MEDIUM In system/workplace/ in Alkacon OpenCms 10.5.4 and 10.5.5, there are multiple Reflected and Stored XSS issues in the management interface. | Aug 27, 2019 | 6.1 | 28 | NO | YES |
CVE-2018-8815MEDIUM Cross-site scripting (XSS) vulnerability in the gallery function in Alkacon OpenCMS 10.5.3 allows remote attackers to inject arbitrary web script or HTML via a malicious SVG image. | Mar 20, 2018 | 4.6 | 28 | NO | YES |
CVE-2023-6380MEDIUM Open redirect vulnerability has been found in the Open CMS product affecting versions 14 and 15 of the 'Mercury' template. An attacker could create a specially crafted URL and send | Dec 13, 2023 | 6.1 | 27 | NO | YES |
CVE-2023-6379MEDIUM Cross-site scripting (XSS) vulnerability in Alkacon Software Open CMS, affecting versions 14 and 15 of the 'Mercury' template. This vulnerability could allow a remote attacker to s | Dec 13, 2023 | 6.1 | 27 | NO | YES |
CVE-2019-11819HIGH Alkacon OpenCMS v10.5.4 and before is affected by CSV (aka Excel Macro) Injection in the module New User (/opencms/system/workplace/admin/accounts/user_new.jsp) via the First Name | May 8, 2019 | 7.8 | 25 | NO | NO |
CVE-2008-1300MEDIUM Cross-site scripting (XSS) vulnerability in the Logfile Viewer Settings function in system/workplace/admin/workplace/logfileview/logfileViewSettings.jsp in Alkacon OpenCms 7.0.3 an | Mar 12, 2008 | 4.3 | 25 | NO | YES |
CVE-2008-1045MEDIUM Cross-site scripting (XSS) vulnerability in the file tree navigation function in system/workplace/views/explorer/tree_files.jsp in Alkacon OpenCMS 7.0.3 allows remote attackers to | Feb 27, 2008 | 4.3 | 23 | NO | YES |
CVE-2008-1301MEDIUM Absolute path traversal vulnerability in system/workplace/admin/workplace/logfileview/logfileViewSettings.jsp in Alkacon OpenCms 7.0.3 and 7.0.4 allows remote authenticated adminis | Mar 12, 2008 | 4.0 | 22 | NO | YES |
CVE-2026-2736MEDIUM Reflected Cross-site Scripting (XSS) in Alkacon's OpenCms v18.0, which allows an attacker to execute JavaScript code in the victim's browser by sending the victim a malicious URL c | Feb 19, 2026 | 6.1 | 21 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (33 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
2 CVEs
6.1% of CVEs· 97th percentile
ExploitDB
7 CVEs
21.2% of CVEs· 90th percentile
Social Chatter
Signals from CVEs in this product scope (33 CVEs).
Media Mentions
Signals from CVEs in this product scope (33 CVEs).
Top CNAs Publishing CVEs For Opencms
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 9.5.1 | 1 | 4.3 | 1.9% | 0 | 0 |
| 8.5 | 1 | 4.3 | 1.9% | 0 | 0 |
| 7.0.4 | 3 | 4.2 | 1.9% | 0 | 2 |
| 7.0.3 | 6 | 4.3 | 1.6% | 0 | 4 |
| 6.2.3 | 1 | 4.3 | 1.9% | 0 | 0 |
| 6.2.2 | 1 | 4.3 | 1.9% | 0 | 0 |
| 6.2.1 | 3 | 4.9 | 1.7% | 0 | 0 |
| 6.2 | 5 | 4.5 | 1.5% | 0 | 0 |
| 6.0.4 | 5 | 4.5 | 1.5% | 0 | 0 |
| 6.0.3 | 7 | 4.5 | 1.5% | 0 | 0 |
| 6.0.2 | 7 | 4.5 | 1.5% | 0 | 0 |
| 6.0.0 | 7 | 4.2 | 1.5% | 0 | 0 |
| 18.0.0 | 2 | 5.8 | 0.2% | 0 | 0 |
| 17.0.0 | 3 | 5.8 | 0.3% | 0 | 0 |
| 16.0.0 | 2 | 5.9 | 0.3% | 0 | 0 |
| 15.0.0 | 1 | 6.1 | 0.6% | 0 | 0 |
| 11.0.2 | 1 | 6.5 | 1.3% | 0 | 0 |
| 11.0.1 | 1 | 6.5 | 1.3% | 0 | 0 |
| 11.0 | 2 | 5.6 | 0.6% | 0 | 0 |
| 10.5.5 | 1 | 6.1 | 3.1% | 0 | 1 |